Marine-CRM Responsible Vulnerability Disclosure Policy

Version: 1.4
Last updated: 23 August 2026

1. Purpose

CIRCLESEA OÜ welcomes good-faith reports that help us protect Marine-CRM, our customers, and professional contact data. This policy explains how to report a suspected security vulnerability and the boundaries for responsible research.

This policy is not permission to access data or systems beyond what is necessary for a minimal, good-faith verification. It does not authorise conduct that is unlawful or that affects a third party's systems or rights.

2. How to report

Email security@marine-crm.com with the subject Security vulnerability report and include, where available:

• your name or chosen identifier and a safe contact method;
• the affected Marine-CRM URL, feature, or component;
• a clear description of the suspected vulnerability and potential impact;
• minimal reproducible steps using your own account and data;
• relevant timestamps, request identifiers, screenshots, or redacted evidence; and
• any immediate containment recommendation.

Do not email passwords, MFA codes, recovery codes, active tokens, private keys, full database extracts, or unredacted personal/customer data. If sensitive evidence is genuinely necessary, first ask us to agree a protected transfer method.

If you believe personal data has been exposed, state this clearly and stop accessing, copying, or testing the affected data.

3. Good-faith research boundaries

Please:

• use only accounts and data that you own or are expressly authorised to test;
• perform only the minimum verification needed to demonstrate the issue;
• stop immediately if you encounter another person's or customer's data;
• avoid changing, deleting, downloading, retaining, or sharing data;
• avoid persistence, privilege expansion, lateral movement, or repeated exploitation;
• preserve confidentiality while we investigate and agree a reasonable disclosure plan; and
• comply with applicable law and third-party terms.

The following activities are prohibited:

• accessing, searching, extracting, downloading, or disclosing another person's or customer's data;
• social engineering, phishing, credential stuffing, password spraying, or attacks against personnel or customers;
• denial-of-service, load/stress testing, spam, automated high-volume scanning, or disruption;
• malware, ransomware, destructive payloads, persistence, or backdoors;
• physical attacks or attempts to access offices, devices, or personnel accounts;
• testing Hetzner, Zone.ee, Snov.io, or another third-party service outside a Marine-CRM-controlled interface;
• evading account, contact-display, export, rate-limit, or other anti-abuse controls beyond the minimum safe proof agreed with us;
• retaining personal data or credentials after reporting; and
• public disclosure before CIRCLESEA OÜ has had a reasonable opportunity to investigate, mitigate, and coordinate disclosure.

If you accidentally access data outside your authorisation, stop, do not copy or share it, describe the minimum necessary facts in your report, and securely delete any unintended local copy when instructed or when preservation is no longer necessary.

4. Our response

CIRCLESEA OÜ will aim to acknowledge a credible report reasonably promptly, assess it according to risk, and maintain reasonable communication where the reporter cooperates with this policy. We may request clarification or a safe retest.

We do not promise a fixed acknowledgement, remediation, or disclosure deadline. Timing depends on severity, complexity, customer/provider dependencies, legal obligations, and the safety of remediation. We may restrict technical details where disclosure could endanger customers, personal data, an investigation, or system security.

5. Coordinated disclosure

Do not publish or share vulnerability details before receiving written coordination from CIRCLESEA OÜ. We will seek to agree a reasonable disclosure plan after we understand the issue, affected parties, remediation, and retest needs.

Any acknowledgement or public credit is discretionary and requires the reporter's consent. We may decline credit where a report is duplicate, non-actionable, abusive, unlawful, or inconsistent with this policy.

6. No bounty or payment

Marine-CRM does not operate a bug-bounty programme at launch. Submission, investigation, remediation, acknowledgement, or credit does not create any right or expectation of payment, reward, reimbursement, contract, employment, or other compensation. Do not incur costs on our behalf without a separate written agreement signed by an authorised representative of CIRCLESEA OÜ.

7. Legal position

Where a researcher uses only their own account and data, performs no more than the minimum safe verification, acts in good faith within the systems and limits described in this policy, and promptly reports and cooperates, CIRCLESEA OÜ does not intend to pursue legal action solely for that compliant research. This limited statement:

• applies only to rights and claims within CIRCLESEA OÜ's control;
• does not bind customers, providers, regulators, law enforcement, or other third parties;
• does not excuse privacy violations, unlawful access, damage, extortion, threats, or non-compliance with this policy; and
• is not a waiver of rights regarding conduct outside this policy.

If you are unsure whether a proposed test is permitted, ask security@marine-crm.com and wait for written authorisation before proceeding.

8. Company details

CIRCLESEA OÜ
Registry code: 17563486
VAT: EE103012063
Address: Võistluse tn 23-44, Kesklinna linnaosa, 10132 Tallinn, Harju maakond, Estonia
Security reports: security@marine-crm.com
Privacy matters: privacy@marine-crm.com

9. Review and changes

We may update this policy as our service and security process evolve. A material change will be dated on the published version. This policy does not replace the Terms of Use, customer agreement, Privacy Policy, or mandatory law.